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REMARKS 

Claims 1-208 are pending in the above-identified application, and were rejected. With 
this Amendment, claims 1, 17, 18, 39, 40, 41, 56, 58, 60, 61, 62, 72, 77, 79, 82, 83, 90, 92, 95, 
96, 97, 98, 99, 114, 117, 120, 135, 138, 140, 141, 142, 150, 151, 152, 153, 155, 158, 159, 160, 
164, 165, 166, 169, 172, 173, 174, 175, 178, 179, 180, 181, 182, 183, 184, 185, 186, 188, 191, 
192, 193, 197, 198, 199, 202, 205, 206, 207, and 208 were amended, claims 10, 32, 51 and 70 
were cancelled, and claim 209 was added. Accordingly, claims 1-9, 11-31, 33-50, 52-69, and 
71-209 are at issue. 

L 35 U.S.C. § 102 Anticipation Rejection of Claims 

Claims 41-59 and 61-71 were rejected under 35 U.S.C. § 102(e) as being anticipated by 
or, in the alternative, under 35 U.S.C. § 103(a) as obvious over Ginter (U.S. Patent No. 
6,253,193 Bl). Applicants respectfully traverse this rejection. 

Claim 41, as amended, is directed to a data providing apparatus that performs mutual 
authentication with the data processing apparatus, encrypts the module using session key data 
obtained by the mutual authentication, and transmits the encrypted module to the data processing 
apparatus. 

Ginter is directed to systems and methods for protecting rights of various participants in 
electronic commerce and transactions. (See Col. 1, lines 21-25). The Ginter embodiment 
entitled "Establishing a Secure Authenticated Communication Channel" gives an example 
process for establishing such a channel, using parties A & B, and identifies how the requirements 
for security and authentication may be established and validated by the parties. (See Col. 218, 
line 31 through Col. 220, line 19). The steps ensure that each party (A & B) has a means of 
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making claims that can be validated by the other party (A or B) and establish the identity of the 
correspondent party and propose a communication. (See Col. 219, lines 1-33). If the proposal is 
accepted, one party (A) may create a session key. Ginter, however, does not disclose or suggest 
a data providing apparatus which performs mutual authentication with the data processing 
apparatus, encrypts the module using session key data obtained by the mutual authentication, and 
transmits the encrypted module to the data processing apparatus. Instead, neither A nor B 
encrypts the communication with the. session key. Therefore, there can be no transmission of an 
encrypted module, as required by claim 41. Accordingly, claim 41, and claims 42-50 and 52-55 
that depend from claim 41 are allowable over Ginter. 

For similar reasons to those discussed above with regard to claim 41, Applicants 
respectfully submit that claims 56-59, 61-69 and 71 are also allowable over Ginter. Claims 51 
and 70 have been cancelled. 

Moreover, claim 41 further includes that the data providing apparatus distributes a 
module storing content data encrypted by using content key data, encrypted content key data, and 
encrypted usage control policy data indicating the handling of the content data to the data 
processing apparatus. In Ginter, every virtual distribution environment (VDE) participant in 
"chain of handling and control" is normally subject to "rules and control." "Rules and controls" 
define the respective rights and obligations of each of the various VDE participants. (See Col. 
56, lines 37-43). The content creator 102 sends the "rules and controls" associated with the 
content to a VDE rights distributor 106. (See Col. 55, lines 39-41). The distributor 106 
generates her own "rules and control" that relate to usage of the content and how much it costs to 
use the content. The usage-related "rules and controls" must be consistent with the "rules and 
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controls" specified by the content creator 102. (See Col. 55, lines 44-51). The content user 1 12 
uses the content in accordance with the usage-related "rules and controls." (See Col. 55, lines 
54-56). The information relating to content use is reported to a financial clearinghouse 116. 
(See Col. 55, lines 57-59). "Rules and controls" may specify which financial clearinghouse(s) 
116 may process payments. (See Col. 56, lines 46-47). Based on its reports and payments it 
receives, the financial clearinghouse 116 may provide reports and/or payments to the distributor 
106. (See Col. 55, lines 63-66). Often, "rules and control" specified by one VDE participant 
cannot be changed by another VDE participant. (See. Col 56, lines 54-56). Ginter does not 
disclose or suggest the data providing apparatus distributing module storing content data 
encrypted by using content key data, encrypted content key data, and encrypted usage control 
policy data indicating the handling of the content data to the data processing apparatus. (See Fig. 
1 and Fig. 2). For these additional reasons, claim 41, and claims 42-50 and 52-55 that depend 
from claim 41 are allowable over Ginter. For similar reasons, Applicants respectfully submit 
that claims 56-59, 61-69 and 71 are also allowable over Ginter. 

For all of the reasons discussed above, Applicants respectfully request withdrawal of this 
rejection. 

IL 35 U.S.C. § 103 Obviousness Rejection of Claims 

Claims 1-40, 60 and 72-208 were rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Ginter (U.S. Patent No. 6,253,193 Bl), in view of Park (WO Publication No. 
99/15947). Applicants respectfully traverse this rejection. 

Claim 1, as amended, is directed to a data providing apparatus that performs mutual 
authentication with the data processing apparatus, encrypts the module using session key data 
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obtained by the mutual authentication, and transmits the encrypted module to the data processing 
apparatus. Claims 1 also includes that a management apparatus manages the data providing 
apparatus and the data processing apparatus. The data providing apparatus sends a usage control 
policy data and requests the management apparatus to certify legitimacy of the usage control 
policy data. The management apparatus registers and services the usage control policy data from 
the data providing apparatus, and certifies the legitimacy of the usage control policy data in 
response to a request from the data providing apparatus. 

As discussed in the example above, Ginter does not disclose or suggest a data providing 
apparatus that performs mutual authentication with the data processing apparatus, encrypts the 
module using session key data obtained by the mutual authentication, and transmits the 
encrypted module to the data processing apparatus. Moreover, as detailed above, Ginter does 
not disclose or suggest a management apparatus that manages the data providing apparatus and 
the data processing apparatus or the data providing apparatus sending a usage control policy data 
and requesting the management apparatus to certify legitimacy of the usage control policy data 
or the management apparatus registers and services the usage control policy data from the data 
providing apparatus, and certifies the legitimacy of the usage control policy data. Thus, it would 
not have been obvious to one skilled in the art at the time the invention to modify the invention 
disclosed in Ginter, with the teachings of Park to derive claim 1, or claims 2-9 and 11-16 that 
depend from claim 1. For similar reasons. Applicants respectfully submit that claims 17-31, 33- 
40, 60 and 72-208 are also allowable over Ginter in view of Park. 

In addition, Claim 17, as amended, is directed to a data processing apparatus utilizing 
content data distributed from a data providing apparatus. The data processing apparatus receives 



Response to June 10, 2005 Final Office Action 
Application No. 09/786,516 
Page 104 

a module storing content data encrypted by using content key data, and encrypted content key 
data. The data processing apparatus determines the handling of content data based on the related 
decrypted usage control policy data. In Ginter, the financial clearinghouse (VDE administrator) 
does not receive or impart "rules and controls." (See. Fig. 2). Therefore, Ginter neither 
discloses nor suggests storing both content data and encrypted content key data in a module or 
the data processing apparatus determines the handling of content data based on the related 
decrypted usage control policy data. For these additional reasons, it would not have been 
obvious to one skilled in the art at the time the invention to modify the invention disclosed in 
Ginter, with the teachings of Park to derive claim 17. 

As discussed above, Ginter does not disclose or suggest the required elements of the 
present invention. Thus, it would not have been obvious to one skilled in the art at the time the 
invention to modify the invention disclosed in Ginter, with the teachings of Park to derive 
claims 1-9, 11-31, 33-40, 60 and 72-208. Claims 10 and 32 have been cancelled. Accordingly, 
Applicants respectfully request withdrawal of this rejection. 
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III. 



Conclusion 



In view of the above amendments and remarks, Applicants submit that all claims are 



clearly allowable over the cited prior art, and respectfully requests early and favorable 



notification to that effect. 



Respectfially submitted. 



Dated: December 12, 2005 
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